IN THE CLAIMS: 

This listing of claims will replace all prior versions, and listing, of claims in the application. 
Listing of the Claims: 

1. (Currently amended) A method of anomaly detection charact e rised in that it 
incorporat e s incorporating the steps of: - 

a) developing a rule set of at least one anomaly characterisation rule from a training 
data set and any available relevant background knowledge using at least first order 
logic, a rule covering a proportion of positive anomaly examples of data in the 
training data set, and 

b) applying the rule set to test data for anomaly detection therein. 

2. (Currently amended) An automated method of anomaly detection characteris e d in that it 
compromis e s incorporating using computer apparatus to execute the steps of: - 

a) developing a rule set of at least one anomaly characterisation rule from a training 
data set and any available relevant background knowledge using at least first order 
logic, a rule covering a proportion of positive anomaly examples of data in the 
training data set, and 

b) applying the rule set to test data for anomaly detection therein. 

3. (Currently amended) A method according to Claim 2 charact e ris e d in that wherein the 
positive anomaly examples are associated with fraud or software vulnerabilities. 

4. (Currently amended) A method according to Claim 2 charact e ris e d in that it includes 
including developing the rule set using Higher-Order logic. 

5. (Currently amended) A method according to Claim 4 charact e ris e d in that it includ e s 
including developing the rule set by: 

a) forming an alphabet having selector functions allowing properties of the training 
data set to be extracted, together with at least one of the following: additional 
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concepts, background knowledge constant values and logical AND and OR 
functions, 

b) forming current rules from combinations of items in the alphabet such that type 
consistency and variable consistency is preserved, 

c) evaluating the current rules for adequacy of classification of the training data set, 

d) if no current rule adequately classifies the training data set, generating new rules 
by applying at least one genetic operator to the current rules, a genetic operator 
having one of the following functions: i) combining two rules to form a new rule, 
ii) modifying a single rule by deleting one of its conditions or adding a new 
condition to it, or iii) changing one of a rule's constant values for another of an 
appropriate type, and 

e) designating the new rules as the current rules and iterating steps c) onwards until a 
current rule adequately classifies the training data set or a predetermined number 
of iterations is reached. 

6. (Currently amended) A method according to Claim 2 charact e ris e d in that wherein data 
samples in the training data set have characters indicating whether or not they are 
associated with anomalies. 

7. (Currently amended) A method according to Claim 6 charact e ris e d in that it is m e thod of 
d e t e cting for detecting telecommunications or retail fraud from anomalous data. 

8. (Currently amended) A method according to Claim 7 charact e ris e d in that it employs 
employing inductive logic programming to develop the rule set. 

9. (Currently amended) A method according to Claim 8 charact e ris e d in that wherein the at 
least one anomaly characterisation rule has a form that an anomaly is detected or 
otherwise by application of the rule according to whether or not a condition set of at least 
one condition associated with the rule is fulfilled. 

10. (Currently amended) A method according to Claim 9 charact e ris e d in that wherein the at 
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least one anomaly characterisation rule is developed by refining a most general rule by at 
least one of: 

a) addition of a new condition to the condition set; and 

b) unification of different variables to become constants or structured terms. 

11. (Currently amended) A method according to Claim 10 charact e ris e d in that wherein a 
variable in the at least one anomaly characterisation rule which is defined as being in 
constant mode and is numerical is at least partly evaluated by providing a range of values 
for the variable, estimating an accuracy for each value and selecting a value having 
optimum accuracy. 

12. (Currently amended) A method according to Claim 1 1 charact e ris e d in that wherein the 
range of values is a first range with values which are relatively widely spaced, a single 
optimum accuracy value is obtained for the variable, and the method includes selecting a 
second and relatively narrowly spaced range of values in the optimum accuracy value's 
vicinity, estimating an accuracy for each value in the second range and selecting a value 
in the second range having optimum accuracy. 

13. (Currently amended) A method according to Claim 12 charact e ris e d in that it includ e s 
including filtering to remove rule duplicates and rule equivalents, i.e. any rule having like 
but differently ordered conditions compared to another rule, and any rule which has 
conditions which are symmetric compared to those of another rule. 

14. (Currently amended) A method according to Claim 13 charact e ris e d in that it includ e s 
including filtering to remove unnecessary f less than or equal to' ("lteq") conditions. 

15. (Currently amended) A method according to Claim 14 charact e ris e d in that wherein the 
unnecessary lteq conditions are associated with at least one of ends of intervals, multiple 
lteq predicates and equality condition and lteq duplication. 

16. (Currently amended) A method according to Claim 8 charact e rised in that it includes 
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including implementing an encoding length restriction to avoid overfitting noisy data by 
rejecting a rule refinement if the refinement encoding cost in number of bits exceeds a 
cost of encoding positive examples covered by the refinement. 

17. (Currently amended) A method according to Claim 8 charact e ris e d in that it includ e s 
including stopping construction of a rule if at l e ast on e of thr ee st e pping crit e ria is 
fulfill e d as follows in response to fulfilment of least one of three stopping criteria, such 
criteria being : 

a) the number of conditions in any rule in a beam of rules being processed is greater 
than or equal to a prearranged maximum rule length, 

b) no negative examples are covered by a most significant rule, which is a rule that: 

i) is present in a beam currently being or having been processed, 

ii) is significant, 

iii) has obtained a highest likelihood ratio statistic value found so far, and 

iv) has obtained an accuracy value greater than a most general rule accuracy 
value, and 

c) no refinements were produced which were eligible to enter the beam currently 
being processed in a most recent refinement processing step (53). 

18. (Currently amended) A method according to Claim 17 characteris e d in that it includ e s 
including adding the most significant rule to a list of derived rules and removing positive 
examples covered by the most significant rule from the training data set. 

19. (Currently amended) A method according to Claim 8 charact e ris e d in that it includ e s 
including : 

a) selecting rules which have not met rule construction stopping criteria, 

b) selecting a subset of refinements of the selected rules associated with accuracy 
estimate scores higher than those of other refinements of the selected rules, and 

c) iterating a rule refinement, filtering and evaluation procedure to identify any 
refined rule usable to test data. 
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20. (Currently amended) Computer apparatus for anomaly detection charact e ris e d in that it is 
programmed to execute the steps of:- 

a) developing a rule set of at least one anomaly characterisation rule from a training 
data set and any available relevant background knowledge using at least first order 
logic, a rule covering a proportion of positive anomaly examples of data in the 
training data set, and 

b) applying the rule set to test data for anomaly detection therein. 

21. (Currently amended) Computer apparatus according to Claim 20 charact e ris e d in that 
wherein the positive anomaly examples are associated with fraud or software 
vulnerabilities. 

22. (Currently amended) Computer apparatus according to Claim 20 characteris e d in that it is 
programmed to develop the rule set using Higher-Order logic. 

23. (Currently amended) Computer apparatus according to Claim 22 charact e ris e d in that it 
includ e s programmed to develop the rule set by: 

a) forming an alphabet having selector functions allowing properties of the training 
data set to be extracted, together with at least one of the following: additional 
concepts, background knowledge constant values and logical AND and OR 
functions, 

b) forming current rules from combinations of items in the alphabet such that type 
consistency and variable consistency is preserved, 

c) evaluating the current rules for adequacy of classification of the training data set, 

d) if no current rule adequately classifies the training data set, generating new rules 
by applying at least one genetic operator to the current rules, a genetic operator 
having one of the following functions: i) combining two rules to form a new rule, 
ii) modifying a single rule by deleting one of its conditions or adding a new 
condition to it, or iii) changing one of a rule's constant values for another of an 
appropriate type, and 

e) designating the new rules as the current rules and iterating steps c) onwards until a 
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current rule adequately classifies the training data set or a predetermined number 
of iterations is reached. 

24. (Currently amended) Computer apparatus according to Claim 20 charact e ris e d in that 
wherein data samples in the training data set have characters indicating whether or not 
they are associated with anomalies. 

25. (Currently amended) Computer apparatus according to Claim 20 charact e ris e d in that 
wherein the at least one anomaly characterisation rule has a form that an anomaly is 
detected or otherwise by application of such rule according to whether or not a condition 
set of at least one condition associated with that rule is fulfilled. 

26. (Currently amended) Computer apparatus according to Claim 20 charact e ris e d in that 
programmed to develop the at least one anomaly characterisation rule by refining a most 
general rule by at least one of: 

a) addition of a new condition to the condition set; and 

b) unification of different variables to become constants or structured terms. 

27. (Currently amended) Computer apparatus according to Claim 26 charact e ris e d in that 
wherein a variable in the at least one anomaly characterisation rule is defined as being in 
constant mode and is numerical, and the computer apparatus is programmed to evaluate 
the at least one anomaly characterisation rule at least partly by providing a range of values 
for the variable, estimating an accuracy for each value and selecting a value having 
optimum accuracy. 

28. (Currently amended) Computer apparatus according to Claim 25 charact e ris e d in that it is 
programmed to filter out at least one of rule duplicates, rule equivalents and unnecessary 
c l e ss than or equal to' (" lteq 22 ) conditions. 

29. (Currently amended) Computer apparatus according to Claim 25 charact e ris e d in that it is 
programmed to stop construction of a rule if in response to fulfilment of at least one of 
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three stopping criteria^ is fulfill e d as follows such criteria being : 

d) a) the number of conditions in any rule in a beam of rules being processed is greater 

than or equal to a prearranged maximum rule length, 

e) b) no negative examples are covered by a most significant rule, which is a rule that: 

i) is present in a beam currently being or having been processed, 

ii) is significant, 

iii) has obtained a highest likelihood ratio statistic value found so far, and 

iv) has obtained an accuracy value greater than a most general rule accuracy 
value, and 

i)c) no refinements were produced which were eligible to enter the beam currently 
being processed in a most recent refinement processing step. 

30. (Currently amended) A computer software for us e in anomaly d e t e ction charact e ris e d in 
that it incorporat e s instructions product comprising a computer readable medium 
containing computer readable instructions for controlling operation of computer apparatus 
to implement anomaly detection, wherein the computer readable instructions provide a 
means for controlling the computer apparatus to execute the steps of:- 

a) developing a rule set of at least one anomaly characterisation rule from a training 
data set and any available relevant background knowledge using at least first order 
logic, a rule covering a proportion of positive anomaly examples of data in the 
training data set, and 

b) applying the rule set to test data for anomaly detection therein. 

31. (Currently amended) A computer software product according to Claim 30 charact e ris e d 
in that wherein the positive anomaly examples are associated with fraud or software 
vulnerabilities. 

32. (Currently amended) A computer software product according to Claim 30 charact e ris e d 
in that it incorporat e s wherein the computer readable instructions provide for controlling 
computer apparatus to develop the rule set using Higher-Order logic. 
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33. (Currently amended) A computer software product according to Claim 32 charact e ris e d 
in that it incorporat e s instructions wherein the computer readable instructions provide for 
controlling computer apparatus to develop the rule set by: 

a) forming an alphabet having selector functions allowing properties of the training 
data set to be extracted, together with at least one of the following: additional 
concepts, background knowledge constant values and logical AND and OR 
functions, 

b) forming current rules from combinations of items in the alphabet such that type 
consistency and variable consistency is preserved, 

c) evaluating the current rules for adequacy of classification of the training data set, 

d) if no current rule adequately classifies the training data set, generating new rules 
by applying at least one genetic operator to the current rules, a genetic operator 
having one of the following functions: i) combining two rules to form a new rule, 
ii) modifying a single rule by deleting one of its conditions or adding a new 
condition to it, or iii) changing one of a rule's constant values for another of an 
appropriate type, and 

e) designating the new rules as the current rules and iterating steps c) onwards until a 
current rule adequately classifies the training data set or a predetermined number 
of iterations is reached. 

34. (Currently amended) A computer software product according to Claim 30 charact e ris e d 
in that wherein data samples in the training data set have characters indicating whether or 
not they are associated with anomalies. 

35. (Currently amended) A computer software product according to Claim 30 charact e ris e d 
in that wherein the at least one anomaly characterisation rule has a form that an anomaly 
is detected or otherwise by application of such rule according to whether or not a 
condition set of at least one condition associated with that rule is fulfilled. 

36. (Currently amended) A computer software product according to Claim 30 characteris e d 
in that wherein the computer readable instructions provide for controlling computer 
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apparatus to develop the at least one anomaly characterisation rule by refining a most 
general rule by at least one of: 

a) addition of a new condition to the condition set; and 

b) unification of different variables to become constants or structured terms. 

37. (Currently amended) A computer software product according to Claim 36 charact e ris e d 
in that it incorporat e s wherein the computer readable instructions provide for controlling 
computer apparatus to at least partly evaluate a variable in the at least one anomaly 
characterisation rule which is defined as being in constant mode and is numerical by 
providing a range of values for the variable, estimating an accuracy for each value and 
selecting a value having optimum accuracy. 

38. (Currently amended) A computer software product according to Claim 35 charact e ris e d 
in that it incorporat e s wherein the computer readable instructions provide for controlling 
computer apparatus to filter out at least one of rule duplicates, rule equivalents and 
unnecessary 'less than or e ual to' (" lteq 12 ) conditions. 

39. (Currently amended) A computer software product according to Claim 35 characterised 
in that it incorporat e s wherein the computer readable instructions provide for controlling 
computer apparatus to stop construction of a rule if in response to fulfilment of at least 
one of three stopping criteria^ is fulfill e d as follows such criteria being : 

g) a) the number of conditions in any rule in a beam of rules being processed is greater 

than or equal to a prearranged maximum rule length, 

h) b) no negative examples are covered by a most significant rule, which is a rule that: 

i) is present in a beam currently being or having been processed, 

ii) is significant, 

iii) has obtained a highest likelihood ratio statistic value found so far, and 

iv) has obtained an accuracy value greater than a most general rule accuracy 
value, and 

i) c) no refinements were produced which were eligible to enter the beam currently 

being processed in a most recent refinement processing step. 
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